Cyber Insurance I don t think it means what you think it means

Size: px

Start display at page:

Download "Cyber Insurance I don t think it means what you think it means"

Terence Jacobs
5 years ago
Views:

1 SESSION ID: GRC-T10 Cyber Insurance I don t think it means what you think it means John Loveland Global Head of Cyber Security Strategy & Marketing Verizon Enterprise Solutions

2 Plot A brief history of the cyber-insurance The current state of the market with some case studies How and why current products fall short What needs to happen for the product and market to mature Getting the odds in your favor 3

3 A (very) brief history of cyber insurance. Fencing, fighting, torture, revenge Early 2000s 2003 CA Security Breach Information Act Mid 2000s 2010s 2016 Few providers 3 rd party coverage Threats covered: Unauthorized access, Network security, Viruses More providers, est. $120M market Added 1st party (IT Forensics, PR, Credit Monitoring / Repair) Threats: Business Interruption, Extortion, Network Asset Damage 50+ providers / $1.2 billion Coverage expansion: Sophisticated threats targeting specific computer systems and organizations big and small But strict sub-limits 60+ providers just in US/ $2.5 billion industry. Bigger carriers starting to pull away Wide variety of coverages and pricing 4

4 We ll never survive! Nonsense. You re only saying that because no one ever has. 6

5 Current state of the market Growing but is it maturing Adoption rates vary significantly depending on industry and location Competition among carriers driving creativity and options Pricing and coverages vary widely as do exceptions making applesto-apples comparisons difficult Underwriting still a matter more of art than science 6

6 The perspective of the purchaser We have a shiny new cyber-insurance policy so we re covered right 7

7 What s covered Get used to disappointment. Payment card loss Inadequate protection E&O Incident response costs Notifications costs Legal defense Business interruption Theft of IP Ransomware payouts Bit-coin Clean-up of publicly disclosed yet-to-be-exploited vulnerability Third-party liability International locations Employee misuse Fees and assessments 8

8 Real-life insurance payouts Source: 2016 Verizon Data Breach Investigations Report 9

9 Real-world example of coverage gap P.F. Chang s (PFC) China Bistro Inc. v. Federal Insurance Co. Agreement Assessments between of the processor PFC and payment triggered by processor the The Cyber-insurance data mandated breach established processor were coverage found that assessments of PFC to third fall would parties outside were was of reimburse the not limited cyber-insurance found to parties to processor that extension coverage for suffered fees imposed of as a the data injury breach. by processor suffered card brands. by did PFC. not suffer injury. Source: 10

skills Evolving cloud technologies Regulatory pressures

10 Cybersecurity is more complex than ever. What about the R.O.U.Ss Vendor overload Rise in cybercrime Shortage of skills Evolving cloud technologies Regulatory pressures More mobility New digital ecosystems Disruptive business models 11

11 As a result, security is becoming increasingly strategic 12 Single, event Perimeter Company s network Technology-led Standards, best practices IT visibility IT Risk Persistent threats/continuous compromise Asset-based Company s network, vendors, cloud Integrated technology, process, people Risk-based, strategic Board, C-level visibility Enterprise Risk 12

12 % Risk Elimination To get to true risk transfer, the risk curve has to shift Protect Mitigate Transfer + Applied Threat Intelligence/Integrated Security Solutions + Asset-Focus/ Detection & Response Traditional Security Efforts $ Security Spend 13

13 A comprehensive risk based approach to insurance is required to shift the curve. Threat rates Vulnerability to attack Impact 14

14 As is standardization of incident reporting. Victim demographics Attack methods Assets affected Type and volume of data disclosed Varieties of impact loss 15

15 But, business also play a key role in maturing the cyber insurance industry. Realize that cybersecurity has never been more complicated or important Understand where risk transference fits into your overall riskmanagement program Acknowledge differences between standard insurance policies and cyberinsurance Enter into a partnership with your insurer 16

16 In the meantime, your best bet is to get the odds in your favor. The battle of wits has begun! Review coverages of existing cyber-insurance policies Address gaps in coverage Understand your incident history Identify gaps in coverage Ensure all stakeholders are part of review and future decisions Additional policies to cover specific loss categories Identify nontransference methods of risk reduction Collect incident and breach data Determine what events happen most often, and which resulted in higher impacts 17

17 Any questions

Cyber-Insurance: Fraud, Waste or Abuse?

SESSION ID: STR-F03 Cyber-Insurance: Fraud, Waste or Abuse? David Nathans Director of Security SOCSoter, Inc. @Zourick Cyber Insurance overview One Size Does Not Fit All 2 Our Research Reviewed many major